CVE-2026-78190: WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form
Source GCVE Database
Not known to be exploited : upgrade to 3.022 soon.
Data as of 31 Oct 2026, 18:09 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 3.022
Exploitation evidence
Disclosed: evidence found.
CVE published 31 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade WebDyne (Perl module) to 3.022.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WebDyne | Affected
| Fixed in
|
CPANWebDynepkg:cpan/WebDyneOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade to WebDyne version 3.022 or later, where the entity_encode method changes mitigate the vulnerability. Since the default auto-escaping setting is off and enabling it has no effect in later versions, upgrading is the recommended remediation.
Description
WebDyne versions from 2.014 before 3.022 for Perl contain a cross-site scripting (XSS) vulnerability. This occurs because request parameters are reflected unescaped into form field values, specifically in textfield, password_field, and filefield tags. The default setting WEBDYNE_CGI_AUTOESCAPE is off, allowing injection of scripts via crafted links. From version 3.022, changes to the entity_encode method render enabling auto-escaping ineffective.